创建、打开 TDE keystore，设置其主密钥并备份（19c+）

命令

-- 1) Keystore location (static parameter, restart required), then keystore type:
ALTER SYSTEM SET WALLET_ROOT = '/u01/app/oracle/admin/ORCL/wallet' SCOPE = SPFILE;
-- SHUTDOWN IMMEDIATE;  STARTUP;
ALTER SYSTEM SET TDE_CONFIGURATION = 'KEYSTORE_CONFIGURATION=FILE' SCOPE = BOTH;

-- 2) In CDB root: create a software keystore (under WALLET_ROOT/tde), open it, set the master key
ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY "<keystore_pwd>";
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN
  IDENTIFIED BY "<keystore_pwd>" CONTAINER = ALL;
ADMINISTER KEY MANAGEMENT SET KEY USING TAG 'mk_2026_10'
  IDENTIFIED BY "<keystore_pwd>" WITH BACKUP USING 'mk_before' CONTAINER = ALL;

-- 3) Open automatically after restart (auto-login, cwallet.sso):
ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE
  FROM KEYSTORE IDENTIFIED BY "<keystore_pwd>";

-- 4) Backup (repeat after every SET KEY / rekey, store SEPARATELY from database backups):
ADMINISTER KEY MANAGEMENT BACKUP KEYSTORE USING 'daily'
  FORCE KEYSTORE IDENTIFIED BY "<keystore_pwd>" TO '/backup/tde/';

-- 5) Status:
SELECT con_id, wrl_type, wrl_parameter, status, wallet_type, keystore_mode
FROM   v$encryption_wallet;
SELECT con_id, key_id, tag, creation_time, activation_time
FROM   v$encryption_keys ORDER BY creation_time;

作用

以 united 模式（所有 PDB 共享 CDB keystore）为 Transparent Data Encryption 建立软件 keystore，创建主加密密钥并启用 auto-login，使其在重启后自动打开。在 19c+ 中推荐使用 WALLET_ROOT/TDE_CONFIGURATION，而不是 sqlnet.ora 的 ENCRYPTION_WALLET_LOCATION。

适用场景

在要求静态数据加密的合规项目（GDPR、PCI-DSS、ISO 27001）中，作为表空间/列加密之前的第一步。

注意

本地部署需要 Advanced Security 选件（额外付费）；Oracle Cloud（OCI/Autonomous）许可中已包含。WALLET_ROOT 是静态参数，需要重启实例（停机）。如果 keystore 及其密码丢失，加密数据将永久无法读取；请将 keystore 备份安全存放，并与数据库备份分开。任何持有 auto-login 文件（cwallet.sso）的人都能打开数据库；请限制文件权限，并在适当时使用 LOCAL AUTO_LOGIN。使用 Data Guard 时，也要将 keystore 复制到备库。